Direct answer
Match the device record to the asset, review sensor health and last reporting, investigate device or connectivity issues, and verify that expected telemetry resumes.
Interpret health status
Microsoft distinguishes active, inactive and misconfigured sensor states in supported Defender deployments. An inactive record can reflect an offline, retired or disconnected device; it is not by itself proof that the sensor was deliberately disabled.
Reference: Microsoft: Check Defender sensor health.
Trace the reporting gap
Confirm the physical asset and management record, owner, last contact and current network status. Check whether the device was replaced or offboarded before taking action. Coordinate supported diagnostics with the endpoint security team and protect diagnostic data.
Verify recovery
After an approved fix or reconnection, check the correct device record for current sensor health and telemetry. Investigate other devices showing the same source or connectivity issue, and track assets that remain offline instead of counting them as healthy.
Distinguish a replaced laptop
A sensor may appear inactive because the asset was rebuilt and the management platform now has a new device record. Match identifiers with the physical laptop and check the new record's telemetry before treating the old record as a live failure. Preserve historical data according to retention policy instead of deleting it immediately.
Assessment limits
Sensor health describes reporting and configuration as observed by the service, not a guarantee that the device has no threats. Product availability and response actions depend on the deployment.
Frequently asked questions
Does an inactive sensor prove compromise?
No. It can also reflect a powered-off, replaced or disconnected device; investigate context.
Does active reporting prove a machine is secure?
No. It indicates the sensor is reporting, not that every threat is absent.
Should an old record be deleted immediately?
Reconcile it with the physical asset and retention requirements before changing records.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.